Privacy policy

Last updated: 2026-10-28

1. Data controller

This site (stebi.me) is operated by MB „Mato“, a small partnership registered in Lithuania. For data protection matters write to [email protected].

2. What we collect

• Anonymous session — when you browse without signing in, you are given a random session identifier (the guest_token cookie) so your carts and watched prices survive between visits.
• Account data — if you sign in with Google or Apple, we receive your name, e-mail address and profile picture from that provider.
• Cart and watch data — the carts you build, the products in them, the price thresholds you set and the notifications you receive.
• Your private entries — if you add your own product or report a different price, those entries are stored against your session or account and are not shown to other users.
• Meal photos — if you use “Meal photo”, the downsized photo, any note you type, the recognition result and what you logged from it are stored against your account so we can check and improve the recognition. They are not shown to other users and are deleted with your account.
• Payment data — if you buy a subscription, card details are handled by Stripe (see section 4); we never see or store card details ourselves.

3. What we use it for

Data is used only to run the core features of the site: storing carts and price watches, sending price-change notifications, managing subscriptions and authenticating accounts. We do not sell data and do not share it for marketing.

4. Third parties

• Stripe — payment and subscription processing.
• Google / Apple — sign-in (authentication), if you choose to use them.
• OpenAI — recognising meal photos and descriptions. Only the photo and the text you typed are sent — no name, e-mail or other account data.
• PostHog (EU data centre) — website analytics and error tracking: pages opened, clicks, errors and, with your consent, visit recordings with typed text hidden. For signed-in users this is linked to the account (id, name, email).

We share no more data with any of them than the service requires.

5. Your rights (GDPR)

Under the General Data Protection Regulation you have the right to access your data, correct it, request its erasure, restrict processing, and the rights to data portability and to object to processing. To exercise these rights, or to have your account and its data deleted, write to [email protected] — we will act on the request within 30 days.

6. Retention

Anonymous session data is kept for as long as you use the site (the session cookie lasts up to 5 years from your last visit). Account data is kept while the account is active or until you ask for it to be deleted.

7. Complaints

If you believe your data is being handled improperly, you may lodge a complaint with a supervisory authority — in Lithuania, the State Data Protection Inspectorate.

Related: Cookie policy, Terms of use.

The Lithuanian version of this document is the legally binding one. This translation is provided for convenience.